How Foundation questions are written

Knowing ITIL and passing the Foundation exam are related but not identical skills. Every year, people who have worked in service management for a decade fail Foundation, and people who started six weeks ago pass it easily. The difference is usually not knowledge but technique: the experienced candidate answers from their own organization's habits, while the new candidate answers from the syllabus. This lesson explains how Foundation questions are built so that you can read them the way the examiner intended.

Exam boards that write multiple-choice tests follow well-established rules. Each question has a stem, which sets up the question, and four options. One option, the key, is correct. The other three, the distractors, are written to be plausible to someone who half-knows the topic and clearly wrong to someone who knows it well. Understanding how distractors are written is the single most useful exam skill you can learn.

The four question styles

Published guides to the Version 5 Foundation syllabus describe four question styles: standard, missing word, list and negative. ITIL 4 Foundation used the same styles. Each style tests the same knowledge in a slightly different shape, and each has its own traps.

Standard questions

Most Foundation questions are standard: a short stem, often one or two sentences, and four options. A recall question asks for a definition or a component: 'What is the purpose of the service desk practice?' An understanding question gives a short scenario and asks you to identify the concept: 'A service provider agrees response times with a customer and reports on them monthly. Which practice is this?'

The key to a standard question is matching the option to ITIL's own wording, not to your experience. Suppose a question asks for the purpose of the problem management practice. One option says 'to restore normal service operation as quickly as possible', another says 'to reduce the likelihood and impact of incidents by identifying actual and potential causes of incidents and managing workarounds and known errors'. Both describe useful work. Only the second is problem management; the first is incident management. The distractor is a correct statement about a different practice, which is one of the most common distractor types.

Here is a standard question written in the Foundation style, using Larchmont as the setting.

Missing word questions

A missing word question gives a sentence from the syllabus with one or two words removed and asks which option fills the gap. For example: 'A ______ is a formal description of one or more services, designed to address the needs of a target consumer group.' The options might be 'service offering', 'service level agreement', 'product' and 'service relationship'. All four are real ITIL terms, which is what makes the question harder than it looks.

To answer missing word questions well, you need to know definitions word for word, or close to it. Read the whole sentence, decide what kind of thing fits (a practice, a component, a type of value, an outcome), and then check which option matches. If two options seem to fit, read the definition of each in your head and see which one contains the words in the sentence. In the example, 'formal description' and 'target consumer group' are the signature words of a service offering.

List questions

A list question gives four numbered statements and asks which of them are correct, or which belong to a category. The options are combinations: '1 and 2', '2 and 3', '3 and 4', '1 and 4'. List questions test whether you can judge each statement separately, and they punish guessing from a single familiar phrase.

The best technique is to mark each statement true or false on your own before looking at the options. If you are sure statement 1 is false, cross out every option containing 1. Often that leaves only one or two options, and judging one more statement decides the answer. Because every option has exactly two numbers, you rarely need to be certain about all four statements.

Negative questions

Negative questions ask which option is not true, which is least likely, or which is not part of something. The syllabus summaries say negative questions are used only exceptionally, but you will probably meet one or two. They are easy marks if you notice the negative word and painful if you do not. Exam writers usually put the negative word in capitals or bold, but under time pressure people still miss it.

A useful habit is to restate a negative question as three true-or-false checks. If the question asks 'Which is NOT a guiding principle?', go through the options and mark each one 'principle' or 'not a principle'. The one that is not a principle is the answer. Treating the question as a search for the odd one out is safer than trying to hold the negative in your head.

How distractors are built

Distractors are not random. Exam writers build them in a few predictable ways, and once you know the patterns you will start to see them everywhere. The table lists the most common patterns in Foundation-style questions.

The 'common practice, not ITIL' pattern catches experienced people most often. Many organizations route every change through a weekly change advisory board, but ITIL describes change authorities assigned by risk and encourages standard, pre-authorized changes. Many service desks are measured on call volume, but ITIL emphasizes user experience and resolution. If an option describes what your workplace does and another describes what ITIL recommends, choose ITIL.

Key words in the stem

Small words in the stem change the answer. Train yourself to notice them. 'Best' and 'most' mean more than one option may be partly correct, and you must choose the one that fits most completely. 'First' means order matters: in the continual improvement model, for example, 'What is the vision?' comes before 'Where are we now?'. 'Purpose' points to the formal purpose statement of a practice. 'Mainly' or 'primarily' asks for the central idea, not every possible benefit.

Reading strategy: stem first, then options

A simple routine helps on every question. First, read the stem slowly and identify what is being asked: a definition, a component, a principle, a practice, an order. Second, try to answer in your head before reading the options. Third, read all four options to the end, even if the first looks right. Fourth, eliminate any options you are sure are wrong. Fifth, choose between what remains by matching ITIL wording.

Answering in your head first protects you from being steered by a plausible distractor. If you think 'this is problem management' and then see an option describing problem management, you can choose it confidently. If no option matches your answer, re-read the stem; you may have misread it, or the question may be testing a different aspect than you expected.

# A small drill: classify stems by style and flag key words to slow down on
stems = [
    "Which practice has the purpose of capturing demand for incident resolution and service requests?",
    "Which is NOT a guiding principle?",
    "A ______ is a formal description of one or more services for a target consumer group.",
    "Which of the following are components of the value system? 1. Governance 2. SLAs 3. Practices 4. Tools",
    "What should be done FIRST when applying the continual improvement model?",
]
flags = ["NOT", "LEAST", "FIRST", "BEST", "MOST", "purpose", "should"]
for s in stems:
    if "______" in s:
        style = "missing word"
    elif " 1. " in s:
        style = "list"
    elif "NOT" in s or "LEAST" in s:
        style = "negative"
    else:
        style = "standard"
    hits = [f for f in flags if f in s]
    print(f"{style:<13}| watch: {', '.join(hits) if hits else '-'}")

standard     | watch: purpose
negative     | watch: NOT
missing word | watch: -
list         | watch: -
standard     | watch: FIRST, should

The drill is crude, but it trains the habit that matters: before answering, name the question style and spot the words that will decide it. Kofi printed a list of the flag words and kept it beside him during his practice sessions until spotting them became automatic.

Answering from the syllabus, not experience

Kofi's first practice set showed the classic experienced-candidate problem. On a question about who should authorize a low-risk change that has been done many times before, he chose 'the change advisory board', because that is how Larchmont worked until last year. The key was 'it is a standard change that is pre-authorized'. On a question about the service desk's focus, he chose 'logging every call within two minutes', a Larchmont target, rather than 'providing a clear path for users to report issues, queries and requests and have them acknowledged, classified, owned and actioned'.

Lena had the opposite problem. Because she knows DevOps well, she sometimes chose options that described good modern practice but used words ITIL does not use. When a question asked which practice ensures that services deliver agreed levels of availability, she hesitated between 'site reliability engineering', which is not an ITIL practice name, and 'availability management', which is. The lesson for both is the same: the exam rewards the ITIL term and the ITIL definition.

Do not overthink

Foundation questions are written to be clear to someone who knows the syllabus. If you find yourself building an elaborate story to justify an unusual answer, stop. The intended answer is almost always the one that matches the textbook definition most directly. Overthinking usually looks like reading extra facts into a scenario: 'but what if the change was urgent?' If the stem does not say it was urgent, it was not.

Overthinking also shows up as changing answers. Studies of multiple-choice tests generally find that when test takers change an answer, they more often change from wrong to right than from right to wrong, so changing is not bad in itself. What hurts is changing on a vague feeling. A good rule is to change an answer only when you can point to a specific word in the stem or a definition that proves the new answer is better.